All Apps and Add-ons

Splunk Common Information Model 4.3.1: What is the CIM field "cpu_time" supposed to contain?

kurdbahr
Path Finder

According to http://docs.splunk.com/Documentation/CIM/4.3.1/User/ApplicationState the field "cpu_time" is of data type "string".
Are there any recommendations regarding the format of this string?

For example tasklist.exe (on Windows) shows the CPU Time as "0:12:34" and ps (on Linux) shows "01:23:45".
This is not a very useful format to do any calculations with.
I could add a calculated numeric field named "cpu_time_seconds" but in a future version of the CIM this field may be defined to mean something completely different.

What are your best practices?
Are there any naming conventions for local CIM extensions?
What are the plans for the future of the CIM?

(And by the way: Does anybody really use the field "cpu_load_mhz" to measure the CPU load per process in Megahertz?)

0 Karma
1 Solution

lguinn2
Legend

I am not the decider of such things, but I believe that you can count on the CIM to be around for a long, long time. I am sure it will continue to evolve and possibly expand, but I expect that changes to existing objects will be infrequent.

The reason that I say this: many of the high-end Splunk apps use the CIM as the basis for integrating diverse data. Splunk Enterprise Security, Splunk IT Service Intelligence and other apps (including some that are not written by Splunk) depend on the CIM. Many additional apps use the CIM as a basis for standardizing names. Consistency across apps makes things easier for users.

And while I don't have time to confirm it, I think that Splunk IT Service Intelligence could make use of "cpu_load_mhz"

Finally, I personally do not know of any naming standards for CIM extensions, but I think you would be wise if you did such a thing.

View solution in original post

0 Karma

lguinn2
Legend

I am not the decider of such things, but I believe that you can count on the CIM to be around for a long, long time. I am sure it will continue to evolve and possibly expand, but I expect that changes to existing objects will be infrequent.

The reason that I say this: many of the high-end Splunk apps use the CIM as the basis for integrating diverse data. Splunk Enterprise Security, Splunk IT Service Intelligence and other apps (including some that are not written by Splunk) depend on the CIM. Many additional apps use the CIM as a basis for standardizing names. Consistency across apps makes things easier for users.

And while I don't have time to confirm it, I think that Splunk IT Service Intelligence could make use of "cpu_load_mhz"

Finally, I personally do not know of any naming standards for CIM extensions, but I think you would be wise if you did such a thing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...